Maritime law, rules and watchkeeping · Level P3 · 5 parts · about 15 min

Ship security officer: the security plan, risk assessment and inspections (STCW A-VI/5)

5 short parts: The SSO · SSA and SSP · DoS & records · Drills & checks · Cyber. Each part explains the idea, then gives the points to remember, the common mistakes, a worked case and a practice question; the Academy unit adds all 30 check questions.

1 · The SSO

The ship security officer: qualification and duties

You manage shipboard security under the master and coordinate with the company security officer (CSO). You need an STCW VI/5 certificate of proficiency.

Who the SSO is

Every ship under the ISPS Code, the International Ship and Port Facility Security Code, has a ship security officer (SSO). The company names this person, who is accountable to the master. The SSO works with the company security officer (CSO), the person ashore responsible for the security of the company's ships, and with the port facility security officer (PFSO) who manages the facility's security and coordinates with visiting ships. On many ships the chief mate or master is the SSO.

The STCW certificate

To be SSO you need a certificate of proficiency under STCW regulation VI/5. You must have approved seagoing service of at least 12 months, or appropriate seagoing service and knowledge of ship operations, and pass approved training to the standard in table A-VI/5. This qualification goes beyond security awareness and designated-security-duties training.

Duties under ISPS A/12

The SSO must: carry out regular security inspections; maintain and supervise the ship security plan (SSP); coordinate the security of cargo and stores with the crew and the PFSO; propose changes to the plan; and report deficiencies found in audits, reviews, inspections and verifications to the CSO, then put corrective actions in place.

More duties

You build awareness, arrange training, report incidents, coordinate the SSP with the CSO and PFSO, and ensure equipment is operated, tested, calibrated and maintained. Under SOLAS XI-2/8, the master decides on safety and security. If requirements conflict, prioritise safety, apply temporary security measures, and immediately inform the flag and, when applicable, the port government.

Where the rest lives

Security levels, threats and reporting are in Security awareness. Access control, searches and patrols are in Designated security duties. This unit covers the planning, records and checks that the SSO owns.

Key figures

Certificate: STCW regulation VI/5; competence table A-VI/5
Sea service: At least 12 months, or appropriate service and ship knowledge
SSO duties: ISPS Code section A/12.2
Accountable to: The master; works with the CSO and each PFSO

Remember

The SSO needs an STCW VI/5 certificate of proficiency.
The SSO is accountable to the master and works with the CSO and PFSO.
Duties: inspections, the SSP, cargo and stores security, reports and training.
The SSO makes sure security equipment is tested, calibrated and maintained.
In a safety–security conflict, the master prioritises safety, applies temporary measures and informs flag/port authorities.

Common mistakes

Wrong: Any officer with designated security duties training can act as SSO.
Right: The SSO needs the VI/5 certificate of proficiency, with approved training and sea service.
Wrong: The SSO reports to the CSO instead of the master.
Right: The SSO is accountable to the master and liaises with the CSO and the PFSO.

Worked case

Your SSO signs off unexpectedly in port. You are the chief mate and hold designated security duties training, but not the VI/5 certificate. The CSO asks you to take over until a relief joins in three weeks. What do you answer?

Show the answer

You cannot act as SSO without the VI/5 certificate. Tell the CSO and the master. The master, if qualified, can take on the role, or the company sends a qualified SSO. Ask the flag if in doubt. Record the change in the security records and tell the PFSO.

Practice question

Which STCW regulation covers the ship security officer's certificate?

Regulation VI/6
Regulation VI/5
Regulation II/2
Regulation VI/1

Show the answer

Answer: B. Regulation VI/5 and table A-VI/5 cover the SSO. VI/6 covers awareness and designated security duties.

2 · SSA and SSP

The security assessment and the ship security plan

The CSO has the ship assessed, including an on-scene survey. The plan built on it is approved by the flag, kept confidential and kept up to date.

The assessment

The ship security assessment (SSA) is the risk assessment behind the plan. The CSO makes sure it is carried out by people with the right skills. It must include an on-scene security survey on board. It identifies existing security measures, key shipboard operations to protect, possible threats and their likelihood, and weaknesses, including human factors. The company documents, reviews, accepts and keeps it.

The SSO's part

The SSO knows the ship best. You show the assessor access points, restricted areas, lighting, locks, alarms and how the crew actually work. You point out weak spots, such as a gangway out of sight of the bridge or a stores door left open at night. Computer systems and networks are part of the survey too.

The plan

The ship security plan (SSP) turns the SSA into measures for each security level. It must cover weapons and dangerous substances, restricted areas, unauthorised access, threats and breaches, government instructions at level 3, evacuation, crew security duties, internal audits, training, drills and exercises, and coordination with port facilities.

Keeping the plan workable

Include procedures for reviewing the plan and reporting incidents. Name the SSO and give the CSO's name and 24-hour contact details. Set out how to inspect, test, calibrate and maintain security equipment, including testing and calibration intervals. Identify the ship security alert system (SSAS) activation points. Explain how to test, activate, deactivate and reset the system, and prevent false alerts. ISPS A/9.4 requires these contents.

Approval

The flag state, or a recognised security organisation (RSO) on its behalf, approves the SSP. An RSO that prepared the SSA or SSP may not approve it. The plan is written in the ship's working language; if that is not English, French or Spanish, a translation into one of them is included. The flag determines which changes to the approved SSP or its security equipment need approval before implementation. Check its requirements before making changes.

Confidentiality

Keep the SSP confidential; protect electronic copies against deletion, destruction or amendment. Port state control (PSC) may inspect relevant sections only exceptionally, with clear grounds and no other way to verify or rectify non-compliance, and with the flag's or master's consent. Sections protected by ISPS A/9.8.1, including restricted areas, threat responses and SSAS details, require agreement of the Contracting Governments concerned, including the flag and port states. Protect all copies from unauthorised access or disclosure.

Key figures

SSA: Under the CSO; includes an on-scene security survey (ISPS A/8)
SSP approval: Flag or an RSO that did not prepare the SSA or SSP (A/9.2)
Language: Working language; plus English, French or Spanish if needed
Amendments: Flag determines which SSP or equipment changes need prior approval
PSC access: Protected sections: agreement of the governments concerned

Remember

The SSA is done under the CSO and includes an on-scene survey.
The SSP is approved by the flag or an RSO independent of its preparation.
The flag determines which SSP or equipment changes need approval before implementation.
The plan is confidential; PSC sees it only in limited cases.
Computer systems and networks belong in the assessment.

Common mistakes

Wrong: The SSO writes and approves the ship security plan.
Right: The CSO arranges the SSA and SSP. The flag or an independent RSO approves the plan.
Wrong: A port state control officer may read the whole plan on request.
Right: The SSP is confidential. Exceptional PSC access needs clear grounds, no other means and consent. Protected sections need agreement of the governments concerned.

Worked case

Your company fits closed-circuit television (CCTV) and a new card-access door to the accommodation. The CSO emails an updated SSP page and asks you to start using it today. What do you check?

Show the answer

Ask the CSO which changes need prior approval under the flag's requirements and obtain evidence of any required approval. Approval on its way is not approval. Keep the approved access arrangements in force; do not implement affected changes before approval. Agree any temporary measures under the current plan with the master and CSO, preserve emergency escape and record the decision. File the approved amendment.

Practice question

Who is responsible for making sure the ship security assessment is carried out?

The master
The CSO
The PFSO
The flag

Show the answer

Answer: B. The CSO makes sure the SSA is carried out by people with appropriate skills.

3 · DoS & records

Declarations of security, records and the security alert system

A declaration of security assigns responsibilities between ships or between ship and port. Records document security work and are kept as the flag requires.

Declaration of security

A declaration of security (DoS) is an agreement between the ship and the port facility, or another ship, on the security measures each will take. It is signed for the ship by the master or the SSO, and for the port by the PFSO or the person responsible for shore security. It lists the activities, the security level and who is responsible for each measure.

When a DoS is needed

The government decides when a port facility needs one. The ship may ask for one when: it is at a higher security level than the port facility or other ship; there is an agreement on DoS between governments; there has been a security threat or incident; the port is not required to have an approved port facility plan; or it does a ship-to-ship activity with a ship that has no approved SSP.

Keeping DoS and port-call information

The flag sets the minimum DoS retention period. Separately, SOLAS XI-2/9.2.3 requires security-information records for the last 10 calls at port facilities. These include security levels, special or additional measures in those ports, and security procedures during ship-to-ship activities. Keep supporting DoS where needed to substantiate those records. A port state may request this information before entry.

Records under ISPS A/10

Record training, drills and exercises; threats, incidents and breaches; level changes; direct security communications; internal audits and reviews; SSA and SSP reviews; plan amendments; and security equipment maintenance, calibration and testing, including SSAS tests. Keep records on board for the flag's minimum period. Use the working language; if it is not English, French or Spanish, include a translation into one of them. Protect records against unauthorised access or disclosure, and electronic records against deletion, destruction or amendment.

The SSAS in one line

The ship security alert system (SSAS), under SOLAS XI-2/6, sends a covert alert ashore identifying the ship and her position, with no alarm on board, from at least two activation points, one on the bridge; how it is tested is in Designated security duties.

Key figures

DoS signed by: Master or SSO for the ship; PFSO or shore security for the port
DoS kept: For the period the flag specifies (ISPS A/5)
Last port calls: Keep security information for the last 10 port-facility calls
Records: ISPS A/10; kept for the period set by the flag
SSAS: SOLAS XI-2/6: covert alert; two activation points, one on bridge

Remember

A DoS is signed by the master or SSO and the PFSO or other ship.
Ask for a DoS when your ship is at a higher security level than the port.
Keep DoS and records for the period your flag sets.
Keep security information for the last 10 port-facility calls, alongside flag-set DoS retention.
ISPS A/10 lists the security records you must keep.

Common mistakes

Wrong: A DoS is needed at every port call.
Right: It is needed when the government requires it or when the ship asks in the listed cases, such as a higher security level.
Wrong: Security records may be thrown away after each voyage.
Right: Keep them for the period set by the flag, and protect them from unauthorised access.

Worked case

Your flag raises your ship to security level 2 while you are alongside a port facility at level 1. The PFSO says nothing has changed for them. What do you do as SSO?

Show the answer

Apply level 2 measures on board at once. Tell the PFSO and ask for a declaration of security, since the ship is at a higher level than the port. Agree who does what: access control, monitoring and cargo checks. Sign it for the ship as SSO or have the master sign. Record the change of level, the DoS and the communications.

Practice question

Who signs a declaration of security on behalf of the ship?

The ship's agent
The master or SSO
The company's CSO
The duty rating

Show the answer

Answer: B. The master or the SSO signs for the ship; the PFSO or a shore representative signs for the port facility.

4 · Drills & checks

Drills, exercises, inspections and control of ships

The SSO plans drills and exercises, inspects the ship and keeps it ready for flag verification and port state control.

Drills and exercises

ISPS B/13.6–13.7 set drill and exercise intervals. These provisions are mandatory in the EU; elsewhere, follow your flag's requirements. Hold security drills at least every 3 months. If more than 25 % of the crew change at once to people not drilled aboard in the last 3 months, drill within one week. Exercises are larger tests, sometimes involving the CSO, PFSO and authorities. Hold them each calendar year, no more than 18 months apart.

Planning drills as SSO

Vary the scenario: a stowaway search, a bomb threat, an unauthorised boarding at anchor, a suspicious package, a cyber incident affecting access control. Test one part of the plan each time, not the same gangway check every quarter. Debrief, record and feed lessons back into training or the plan. The crew's hands-on skills are in Designated security duties.

Security inspections

The SSO carries out regular security inspections at intervals set in the SSP. Check access points, locks and seals on restricted areas, lighting, alarms and CCTV, the visitor log, the SSAS test record and whether watches follow the plan. Record deficiencies, report them to the CSO, arrange corrective action and follow up.

Verification and the ISSC

The flag or RSO verifies the ship and issues the International Ship Security Certificate (ISSC). Verifications are initial, at least one intermediate between the second and third anniversary dates, and renewal; the certificate is valid for up to 5 years. A new ship or new company may get an interim ISSC valid for 6 months.

Control measures

Under SOLAS XI-2/9, port states check that a ship in port has a valid ISSC. Clear grounds of non-compliance can lead to proportionate inspection, delay, detention or restrictions on operations. Expulsion or denial of entry requires clear grounds that the ship poses an immediate security or safety threat, with no other appropriate way to remove it. Before arrival, port states may request security information. General port state control procedures are in Ship business.

Key figures

Security drills: At least every 3 months (ISPS B/13.6)
Crew change rule: >25 % new and not drilled here in 3 months: drill within 1 week
Exercises: Once each calendar year, ≤18 months apart (ISPS B/13.7)
ISSC: Up to 5 years; intermediate between 2nd and 3rd anniversary
Interim ISSC: 6 months
Control measures: Inspect, delay, detain, restrict; expel only under strict conditions

Remember

Drills at least every 3 months; if more than 25 % are replaced by crew not drilled aboard in 3 months, drill within one week.
Exercises once each calendar year, no more than 18 months apart.
SSO inspections follow the intervals in the SSP.
ISSC up to 5 years, with an intermediate verification.
Port states may inspect or detain; expulsion or denied entry needs an immediate threat with no other appropriate remedy.

Common mistakes

Wrong: An exercise can replace the quarterly drills.
Right: Drills and exercises are separate. Keep the 3-monthly drills as well as the yearly exercise.
Wrong: The ISSC needs an annual verification.
Right: The ISSC has an intermediate verification between the second and third anniversary dates, plus renewal.

Worked case

Your ship changes 7 of her 22 crew in Rotterdam. Two of the joiners took part in a security drill on board 6 weeks ago; the other five have never sailed on her. The last drill was 6 weeks ago. What do you plan?

Show the answer

Only the five who have not drilled on board in the last 3 months count: 5 of 22 is about 23 %, below the 25 % trigger, so the one-week rule does not apply. Hold the next drill within the 3-month cycle, but do it soon: give the newcomers a security familiarisation now and use a drill early that tests access control. Record the familiarisation and the drill.

Practice question

How often should security drills be held under ISPS B/13.6?

At least once a week
At least once a month
At least every 3 months
At least once a year

Show the answer

Answer: C. Security drills are held at least once every three months.

5 · Cyber

Cyber risk management in the SMS and the SSP

Cyber risk is managed in the safety management system. The SSO makes sure security systems and networks are in the assessment and drills.

Cyber risk in the SMS

Resolution MSC.428(98) affirms that an approved safety management system (SMS) should take cyber risk into account under the International Safety Management (ISM) Code. It encouraged flag Administrations to ensure this by the first annual verification of the company's Document of Compliance (DOC) after 1 January 2021. Manage cyber risk through the SMS; the resolution supports implementation of the ISM Code rather than creating a separate mandatory cyber code.

The guidelines

The IMO Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.3 of 4 April 2025, replace earlier versions. They are guidance, not mandatory. They ask companies to set policy and responsibilities and to work through functional elements such as identify, protect, detect, respond and recover. Industry guidance gives the practical detail.

New ships: IACS UR E26 and E27

IACS is the International Association of Classification Societies. Its unified requirements are technical rules applied by member societies. E26 covers the ship's cyber resilience: its ability to keep working or recover after a cyber incident. E27 covers onboard systems and equipment. For ships within their scope, the revised rules apply to construction contracts dated on or after 1 July 2024. Check your ship's class rules for applicability.

Cyber and the SSO

Access control, CCTV, alarms and the SSAS can depend on networks. ISPS Part B lists computer systems and networks among the things the SSA should consider. Make sure your plan says what to do if card access or CCTV fails. Use a cyber incident as a drill scenario, record it, and agree with the company's IT lead how incidents are reported.

Work at the IMO

In June 2025 MSC 110 agreed to develop a non-mandatory, goal-based Maritime Cybersecurity Code, with proposals invited to MSC 111. Development of the new code does not postpone cyber risk management through the SMS. Crew cyber habits are in Security awareness.

Key figures

Cyber in the SMS: Flag target: first annual DOC verification after 1 Jan 2021
IMO guidelines: MSC-FAL.1/Circ.3/Rev.3, 4 April 2025 (non-mandatory)
IACS UR E26 / E27: Covered new ships: construction contracts from 1 July 2024
IMO work: MSC 110 (2025): non-mandatory cybersecurity code in development

Remember

MSC.428(98) affirms that cyber risk belongs in the SMS under the ISM Code.
The current IMO guidelines are MSC-FAL.1/Circ.3/Rev.3 (2025).
For ships within their scope, UR E26/E27 apply to new construction contracts on or after 1 July 2024.
Include security systems and networks in the SSA, the SSP and drills.
The proposed IMO cyber code is non-mandatory; existing SMS cyber-risk duties still apply.

Common mistakes

Wrong: Cyber security is an IT matter and has nothing to do with the SMS.
Right: Cyber risk belongs in the SMS under the ISM Code; MSC.428(98) affirms this. The SSO includes security-system failures in the SSA, SSP and drills.
Wrong: IACS UR E26 and E27 apply to every ship in class since 2024.
Right: For ships within their scope, E26/E27 apply to new construction contracts on or after 1 July 2024. Check your ship’s class rules for applicability.

Worked case

At anchor at security level 1, the card-access system for the accommodation fails and all doors unlock. The IT log shows a strange login from the crew Wi-Fi an hour earlier. What do you do as SSO?

Show the answer

Tell the master and CSO. Apply the SSP's fallback access controls while preserving emergency escape. Follow the SMS cyber-incident procedure with the company's IT lead; isolate affected systems only as authorised and safe. Preserve logs and record the incident. Review the SSA, amend the SSP through the approval process if needed, and test the revised arrangements in a drill.

Practice question

The company keeps cyber risk solely in an IT policy outside the SMS. What should you advise?

Manage cyber risk through the approved SMS
Keep it solely in the separate IT policy
Wait until the next five-year ISSC renewal
Apply it only to newly contracted ships

Show the answer

Answer: A. MSC.428(98) affirms that an approved SMS should take cyber risk into account under the ISM Code. A separate IT policy alone does not meet that purpose.